Privacy Policy

This Privacy Policy explains how AICY, Inc. ("AICY", "we", "us") collects, uses, discloses, and safeguards personal information when you use Numen — our AI operating system for finance, including the Numen Plan (FP&A) and Numen Books (cost accounting) modules, our websites, and related services (collectively, the "Services").

Numen is a business-to-business product built for finance teams. We act as a processor for the customer content you upload, and as a controller for account, billing, support, and website data. This policy is effective as of the date shown above.

1. Information we collect

Account and contact data

• Required: business email, password, name, company name, and job title.

• Optional: phone number and marketing preferences.

Billing data

• Billing contact, subscription and invoice history, and business registration number where tax documents are issued. Payment instrument details are handled by our payment provider; we never receive or store full card numbers.

Customer content

• Financial data you upload or connect — general ledger and sub-ledger exports, trial balances, budgets, and related spreadsheets — together with the analyses, forecasts, and reports generated from them. We process this content only on your instructions, as your processor.

Usage and device data

• IP address, access timestamps, browser and operating-system information, and referring page.

• Product-usage events — API request paths, response statuses, latency, and the trace, user, and company identifiers used to correlate them.

• Error diagnostics (message, stack trace, and the route where the error occurred).

• Identifiers and settings stored in cookies and browser local storage. See our Cookie Policy.

Enquiry and support data

• Name, email, company, the content of your enquiry or chatbot conversation, and the IP address, user agent, and page URL captured when the form is submitted.

We do not collect sensitive categories of personal data or government identifiers. Please do not include them in uploaded content.

2. How we use information

• Provide, operate, secure, and improve the Services.

• Authenticate users, manage subscriptions, and process payments.

• Generate forecasts, scenarios, variance analyses, and reports from your content.

• Respond to support requests and send service and, where permitted, marketing communications.

• Detect, prevent, and address fraud, abuse, and security incidents.

• Comply with legal obligations.

3. Legal bases (EEA / UK)

Where the GDPR or UK GDPR applies, we process personal data on the basis of contract performance, our legitimate interests (e.g., securing and improving the Services), your consent (e.g., marketing), and compliance with legal obligations.

4. AI processing

Numen is model-agnostic. To generate outputs, the relevant portion of your content is sent to large-language-model providers acting as our subprocessors — Anthropic (primary), and Google and OpenAI depending on the task.

We reach these providers through their APIs, whose terms do not use submitted content to train their models by default, and we do not opt in to training. We do not train models of our own, we do not sell your content, and we do not use one customer's content to improve outcomes for another.

AI features propose results — account classification, statement mapping, ledger analysis, commentary — and a person on your team reviews and confirms them. Classifications you upload are never silently overwritten. The Services therefore do not make decisions about you by automated means alone. You may ask us to explain any AI-generated result or to have it re-processed with human involvement.

5. Subprocessors

We engage vetted service providers under written data-processing terms:

6. How we share information

We share personal data only with: (a) the subprocessors listed above; (b) authorities where required by law or valid legal process; and (c) an acquirer in the event of a merger, acquisition, or asset sale, subject to this policy and to prior notice. We do not sell personal information.

7. International transfers

Our primary infrastructure runs in the Republic of Korea, which the European Commission recognised as providing an adequate level of data protection on 17 December 2021; the United Kingdom adopted equivalent adequacy regulations in 2022. Transfers of personal data from the EEA and the UK to AICY are made on the basis of those decisions.

Some processing takes place in Japan and the United States, as shown in the table above.

8. Data retention

We retain records longer only where Korean commerce and tax law requires it (generally five years for contract, payment, and supply records).

9. Security

We apply administrative, technical, and physical safeguards, including encryption in transit and at rest, least-privilege access controls, per-tenant data isolation enforced at the database layer, audit logging, and regular reviews. No method of transmission or storage is completely secure.

10. Your rights

Subject to your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, to withdraw consent, and to obtain an explanation of automated processing. To exercise any of them, contact numen-support@aicy.ai. We verify requests against the account on file and respond within the period the applicable law allows (45 days for US state laws, extendable once; one month under the GDPR). We will not discriminate against you for exercising these rights.

If we decline a request, you may appeal by replying to our decision with the word Appeal. We will respond to the appeal within 45 days and, where required by your state's law, tell you how to contact its Attorney General.

Notice at collection (California)

We collect the categories of personal information described in section 1 — identifiers, professional information, commercial information, and internet activity — for the purposes in section 2, and retain them for the periods in section 8. We do not collect sensitive personal information for the purpose of inferring characteristics.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Because we do neither, there is nothing to opt out of — but we still honour the Global Privacy Control signal and treat it as an opt-out of non-essential storage.

US state privacy laws

Residents of states with comprehensive privacy laws — including California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, Nebraska, Iowa, Indiana, Kentucky, Rhode Island, Tennessee, Utah, and Washington — have rights to know, access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We conduct none of those three activities. Where your state recognises a universal opt-out mechanism, we honour Global Privacy Control.

Note that most US state privacy laws exclude personal information processed in a purely business-to-business or employment context. Numen is a B2B product, so many of these rights will apply to our website visitors rather than to our customers' authorised users.

Customers' end users

Where personal data reaches us inside a customer's uploaded content, that customer is the controller and we act on its instructions. Direct your request to the customer; if you send it to us, we will forward it and will not respond substantively.

11. Children

The Services are not directed to children and are intended solely for business use by adults with authority to bind their organization.

12. Changes to this policy

We may update this policy from time to time. Material changes are announced at least 30 days before they take effect, with a before-and-after comparison; minor changes are posted at least 7 days in advance.

13. Contact

• Legal entity: AICY, Inc. (아이씨 주식회사)

• Business registration no.: 331-81-02537

• E-commerce filing no.: 2022-Seongnam Bundang A-1007

• Address: 180 Bangbae-ro, Seocho-gu, Seoul, Republic of Korea

• Email: numen-support@aicy.ai

Privacy enquiries: numen-support@aicy.ai.

Personal Information Protection Officer (designated under the Korean Personal Information Protection Act): Bom Lee, Chief Executive Officer.